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Practical implementations of quantum cryptography use attenuated làser pulses as the signal 
source rather than single photons. The channels used to transmit are also lossy. Here we give 
a simple derivation of two beam-splitting attacks on quantum cryptographic systems using làser 
pulses, either coherent or mixed states with any mean photon number. We also give a simple 
derivation of a photon-number splitting attack, the most advanced, both in terms of performance 
and technology required. We find bounds on the maximum disturbance for a given mean photon 
number and observed channel transmission efnciency for which a secret key can be distilled. We 
start by reviewing two incoherent attacks that can be used on single photon quantum cryptographic 
systems. These results are then adapted to systems that use làser pulses and lossy channels. 



I. INTRODUCTION 

Quantum cryptography is, in theory, unbreakable 0, 
^| . The laws of quantum mechanics allow a sender of a 
message and a receiver, known as Alice and Bob respec- 
tively, to defeat an eavesdropper, Eve, from accessing 
their Communications. In the first quantum cryptogra- 
phy protocol discovered in 1984 by Bennett and Brassard 
(BB84) H the idea is that Alice encodes the logical bit 
vàlues and 1 on to four possible polarisation states of 
a photon, two in one basis such as horizontal and verti- 
cal polarisation (|x) and \y) respectively) and two in the 
conjugate basis, an equal superposition of the first basis. 
These photons could be encoded as having 45° and —45° 
polarisation (\u) and \v) respectively). Alice randomly 
sends one of them to Bob who will then measure each of 
the photons in one of the two bases also randomly and 
independently from Alice. After Bob has made his mea- 
surement, Alice reveals on a públic channel the basis in 
which she sent her photon. Bob then telis her whether or 
not he measured in the same basis. If he did not or he did 
not detect a photon, the bit is discarded but if the same 
basis was used they keep the bit and both parties should 
now hold the same result of the bit's value. The proce- 
dure is repeated until Alice and Bob hold a long string 
of bits. This is their sifted key and they should have 
perfectly correlated bit strings. If, however, a malicious 
eavesdropper, Eve, was listening in an effort to obtain 
some of the key's information, she must make measure- 
ments on the states Alice sends to Bob. In doing this 
she will sometimes choose the wrong measurement and 
create errors in Alice and Bob's sifted key providing a 
signature of her presence to Alice and Bob when they 
come to a process called error correction and estimation. 
Alice and Bob sacrifice a subset of their key in order to 
do this and from their estimate of the error rate they 
may also calculate the maximum amount of information 
an eavesdropper could have obtained, a limit bounded by 
the laws of physics but as yet still unknown. 

Bounds for specific attacks have been found; these are 
usually attacks in which the eavesdropper measures each 
individual state Alice sends to Bob known as incoherent 
attacks. Incoherent attacks on the BB84 protocol usually 



have the added restriction that they take into account 
information gaincd by the eavesdropper after públic an- 
nouncement of the basis but before error correction and 
privacy amplification. The optimal bound of an unre- 
stricted attack using collective measurements of any size 
is still unknown. These may not be severe limits to the 
security of quantum cryptography at present because the 
technology needed to perform the simplest of controlled 
interactions on more than a few qubits is still at an early 
stage. 

In reality however, there are added complications. All 
errors do not generally come from an eavesdropper alone. 
There will be noise in Bob's detectors and in the quan- 
tum channel they use to setup the key as well as equip- 
ment misalignments. Real implementations of quantum 
cryptography also have losses during transmission and 
they do not at present use single photon sources. In- 
stead, attenuated làser pulses that may contain 0, 1, 2 
or more photons are used as Alice's signal source. Prac- 
tical implcmentation of quantum cryptography opens a 
security loophole and Eve may adapt her attacks to take 
advantage of these facts. We give a simple derivation of 
incoherent eavesdropping attacks on these imperfect sys- 
tems. We give a general argument that applies equally 
well to systems with high mean photon number pulses as 
we make no approximation. These results apply equally 
well to coherent states as to mixed photon number states 
with Poissonian distribution. Three attacks are analyzed 
in increasing order of technological sophistication of the 
eavesdropper. This is another important point: the prac- 
tical quantum cryptography system need only prevent 
the most technologically powerful eavesdropper at the 
time key distribution takes place. This is unlike classical 
cryptography where a message may be stored until an 
eavesdropper has the technology with which to break it 

Provided Alice and Bob can calculate the maximum 
level of information Eve could have obtained on their key 
from error estimation and by making a decision on how 
advanced her attack could have been in the worst case, 
Alice and Bob may be still able to distill a secret key 
on which Eve has negligible information using a classical 
process called privacy amplification H. Finding these 
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limits is important for the security of quantum cryptog- 
raphy which could take into account the technology of 
the eavesdropper and should include the settings and lim- 
its of Alice and Bob's equipment as well as fundamental 
physics. We give bounds on the maximum error rate 
Alice and Bob can tolerate for a realistic system with 
channel losses and làser pulses as the signal source for 
three incoherent attacks increasing in the technological 
power of the eavesdropper. 

The paper is organized as follows. We start by re- 
viewing eavesdropping attacks where Alice uses a single 
photon source to send key bits to Bob in section [iï| We 
review two strategies: The simplest strategy that Eve can 
employ, that of intercept-resend, a strategy whose imple- 
mentation is well within the reach of current technology 
to that of the optimum incoherent attack for which the 
technology is not yet available. This latter attack in- 
volves storing quantum states for long times and well 
controllcd intcractions between a probe (one or more 
qubits) and the state the eavesdropper is trying to iden- 
tify. These strategies provide the foundations for sec- 
tion HJ, eavesdropping on systems that use làser pulses 
and have a quantum channel with a transmission effi- 
ciency that may be less than unity. Beam-splitter attacks 
are analyzed in detail using intercept-resend or optimal 
incoherent attacks. Lastly, the photon-number splitting 
attack is analyzed, the most advanced strategy an eaves- 
dropper could use and relies on performing unlimited ef- 
ficient quantum non-demolition measurements: technol- 
ogy tha t is u nlik ely to be available for a long time. In 
sections EI C and III G we present some analysis on what 
Alice and Bob can do to countcr Evc's attacks. 



II. INCOHERENT EAVESDROPPING: SINGLE 
PHOTON SOURCES 

Presented here are two attacks that an eavesdropper, 
Eve, can employ depending on the sophistication of her 
technology on a perfect quantum cryptographic system 
using the BB84 protocol. The simplest, an intercept- 
resend strategy, could be implemented with equipment 
currently available whereas an attack using the optimal 
incoherent strategy would require an advance in technol- 
ogy. The latter attack belongs to class sometimes referred 
to as 'translucent attacks with entanglement' B. 



Presented here is an argument adapted from [M ||] . Eve 
makes her measurement on a state and given her result 
she makes the best guess as to what the logical bit value 
of the state was that Alice intended Bob to receive. Eve 
then prepares one of the two states in the intermediate or 
Breidbart basis depending on this guess and sends it on to 
Bob. As we shall see, the two intermediate states belong 
to the same basis in which Eve makes her measurement. 

The four states Alice can send to Bob in the BB84 
protocol are 

\x) = ^(\u) + \v)) 



\y) = —(\ U )-\v)) 



\u) = -^(\x) + \y)) 



\v) = -j={\x) - \y)) 



(1) 



Eve does not have to guess the state with the best prob- 
ability of being correct. Alice and Bob are trying to set 
up a key composed of ls and Os. It does not matter what 
state it is if Eve is only trying to find out the vàlues of the 
bits. Alice must encode her states as in figurc @. Note 
that the logical bit vàlues for the two states in the same 
basis must be different otherwise públic announcement of 
the basis would result in Eve knowing everything about 
the key by simply passively monitoring this públic con- 
versation. Eve's best chance of guessing the value of the 
bit with a simple, presently implementable measurement 
is to have two outeomes Mq and M\. The probability of 
guessing the bit value correctly is 



P c = -[(x\M \x) + (v\M \v) + (i/lMily) + (u^u)] (2) 

Where the two measurement operators have to satisfy 
A/o + Mi = 1.1 the identity matrix. The measurement 
operators are 



M n = 



A. The intercept-resend strategy 

The idea with this kind of attack is to measure all 
or a proportion, e, of the states Alice sends to Bob. If 
she chooses to measure only a fraction, e, of the states, 
how she chooses which states to measure is dependent 
on how much information she wishes to obtain on the 
final message while making her presence as inconspicuous 
as possible. We will not consider how she chooses this 
fraction. 



Mi = |l)(l| (3) 
The two states |0) and |1) are given by 

|0) =cos0|a;) -sin%) (4) 

|1) = sin%) +cos%) (5) 
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\x) 



the time and send Bob |0). Eve may also get the result 
Mi a proportion 1 — P c of the time and guess the value 
of the state incorrectly. In this case she sends |1). Eve 
causes an error in Alice and Bob's key when Bob gets the 
result that \y) was sent. This probability, D, that Eve 
causes a disturbance or error is 



D = P C (0\My\0) + (1 - P C )(l\My\l) 



(10) 



Where M y — \y)(y\ is the outcome of Bob's measurement. 
It is suíficient to analyze only this case only without the 
prior probability weightings of \x), \y) etc. being sent if 
they are all equal. Equation (fL0|) reduces to 

D = 2P C (1 - P c ) 




FIG. 1: The four states of the BB84 protocol represented by 
their logical bit vàlues. 



Where 9 is a variable angle taken clockwise from \y). 
Substituting the forms of Mq and M\ into equation (Q) 
we get 



P c = ~ + Í[cos2é> + sin2é>] 



(6) 



To find the measurement basis that gives the best chance 
of guessing the bit value correctly we maximize P c with 
respect to 9 i.e. 



dP c 
d9 



1 



sin20-cos20] = 



(7) 



This gives tan 29 = 1 or 9 = vr/8 = 22.5°. |1) is orthog- 
onal to |0) and 22.5° clockwise from \y). This is known 
as the intermediate or Breidbart basis. Substituting the 
value of 9 into equation (^|) gives P c = 1/2(1 + l/y/2). 
The intermediate states, are now given by 



|0) = cos(tt/8)|x) - sin(7r/8)|y) 



(8) 



D 



(11) 



If Alice and Bob see that a quarter of the bits in their 
sifted key are incorrect while error checking, this is a 
give away that Eve was on the line. To mask her presence 
more carefully Eve can measure a proportion of the states 
e. In this case Eve's probability of guessing the state 
correctly is 



1 



Where the last term on the right comes from the fact that 
Eve can guess with an 50/50 chance the identity of the 
bit vàlues she did not measure. The disturbance becomes 

D(e) = \ 

Combining these two expressions we get the probability 
of Eve guessing the bit value correctly as a function of 
D. 



P C {D) = V2D 



1 



(12) 



Note that D r< 



1/4 as this is when e = 1. 



B. The optimal incoherent strategy 



|1) = sin(7r/8)|af) + cos(7r/8)|y) (9) 

We have now found the best basis in which to guess 
the value of the bits Alice has encoded on to the quanta. 
Alice and Bob check for Eve's presence by measuring the 
proportion of errors in their sifted key after the públic 
announcement of the basis. It turns out that Eve mini- 
mizes the disturbance to the sifted key by recording the 
value of her measurement, either Mq or Mi, thcn scnd- 
ing on to Bob one of two states in the measurement basis 
either |0) or |1) i.e. if Alice sends |a;) Eve will make her 
measurement and get the result Mq a proportion P c of 



This strategy is reported from Fuchs et al. || who 
proved it to be the optimum incoherent strategy an eaves- 
dropper can use on an ideal quantum cryptography sys- 
tem using the BB84 protocol. The derivation given here 
was first given by Cirac and Gisin ||ïof who found a sim- 
ple symmetry argument that gives the same result. This 
attack is not available to an eavesdropper with present 
technology. 

The idea is to evolve a probe in some initial Standard 
state, \a), into distinct probe states dependant on the 
state of Alice's photon with which the probe is inter- 
acted with. The probes can then be stored until Alice 
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and Bob announce the basis so that Eve can increase her 
chance of distinguishing the probe (and Alice's state) by 
choosing the best measurement for that particular ba- 
sis. Simultancously Eve wants to make the state she is 
scnding to Bob as much alike to the state Alice sent to 
minimize the disturbance or error rate to the sifted key. 
We have the following interactions for the x-y basis. 



\a) ® \x) — ^ \a x t) ® \x) + \<%P 



\a) ® 



\a%) ® \x) 



ni / 



(13) 



(14) 



with similar interactions for the u-v basis. The second 
kets in each tensor product on the right hand side after 
tracing out the probe states form the mixed state Bob 
will receive. The first kets in each tensor product after 
tracing out Bob's system will form the mixed state Eve 
will keep. Notice that the probe states \a%j' vv ) are not 
normalized yet. These two interactions can be written 
more neatly in matrix form. 



a) <8> 



\y) 



(15) 



Where e xy is the matrix containing the (un-normalized) 
probe states. A similar expression can be constructed for 
the u-v basis simply by changing subscripts. The probe 
state matrices in either basis have the form 



aoo) 
oio) 



|O01, 



(16) 



Using the Hadamard transform, H, we can transform this 
matrix of probe states from one basis to the other. The 
transform is 



where H is 



H = ií f 



He xy HÏ 



J_/l 1 
V2V 1 



(17) 



(18) 



Here we introduce the symmetry part of the argument. 
We are going to impose the conditions that 

(i) All overlaps between probe states should be invari- 
ant under the change of labels < — > 1. This means 
(aio|oix) = (ooi|ooo) etc. 

(ii) Overlaps between states in one basis should be 
the same as overlaps in the other basis. For example 



^00 l"*00/ 



*00 1^00/ 



Going back to equation jï^ ) we need to normalize the 
probe states and enforce the unitary evolution condition 
(that overlaps should be preserved). Normalization re- 
quires 



{aoo\aoo) 



(«oi aoi; 



(19) 



From the symmetry requirement (i) and defining two pa- 
rameters F and D we have 



(aoo I aoo) 



(au an> 



F 



and 



(aoi|a i) = (aioKo) = D 



(21) 



(22) 



where F + D = 1. From the unitary condition i.e. taking 
the overlaps of equations (13), (fl·l) we have 



(23) 



(aoo|aio) + (a i|an) = 



and by imposing symmetry condition (i) equation (|2 
becomes 



(an|a i) + (oio|aoo) = 



(24) 



We shall also impose that all overlaps are real numbers 
i.e. (aoo|aoi) = (aoi| a oo) which you can do by careful 
choices of the local phase of the states. Now because the 
overlaps are real 

(aoo|oio) = 



(«01 «li/ 



(aulooi) = 



(aio|a o) 







(25) 



This means all these probe states are orthogonal to one 
another. We will also define some final parameters F\ 
and Di that characterize the overlap of the remainder. 



(aooKi 



Fi 



(aio|a i) = (a i|ai ) = Di 



(26) 



(27) 



What we are doing is basically defining the unitary trans- 
form U that we want to perform on the states. We al- 
ready know the relation F + D = 1 , now we need another 
formula to relate the final variables F\ and D\ . We can 
do this from symmetry argument (ii). By transforming 
the probe states in one basis to their representation in 
the other basis using equation (O) then we get 



(28) 



F - D = F 1 + Di 



We can re-write equations ( |Ï3| ) and ( |Ï4"| ) with the probe 
states normalized. Normalized probe states from now on 
will be denoted with a hat i.e. \à). The normalized states 
are 



(au au) + (a w \a w ) 



(20) 



|a) ® \x) 



F\à x Q y o) 



® \x) 



D\àH) 



® \v) (29) 
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® \y) 



® X) 



(30) 



There are similar relations for the u-w basis as well thanks 
to the symmetry condition (ii), but because of this sym- 
metry it is sufficient to analyze just one basis and carry 
the results over to the other basis. F as it appears here is 
the fidelity. Note from equations (|2^) , (^Ü|) that these are 
entangled states. Looking specifically at equation (29), 



when Bob makes his measurement in the basis that Al- 
ice sent the state in, the only states that will eventually 
form the sifted key, he can get two outcomes. Either the 
state was \x) which occurs with probability F in which 
case the superposition will collapse and Eve's probe state 
instantaneously jumps to |Óqq). This means Eve has got 
away without causing a disturbance. The other outcome 
is \y), an error or disturbance in Alice and Bob's sifted 
key occurring with probability D. Just because Eve got 
away without causing disturbance a proportion F of the 
time does not necessarily mean she will conclude cor- 
rectly what the state Alice sent was. Now Eve has to dis- 
criminate between two density matrices because she can 
store her probes until the basis is publicly announced and 
choose the best measurement to determino which density 
matrix it was. Eve's mixed states are 



Pi = tr Bob [U{\a) ® \i)(a\ <g> <z|)t^ t ] 



(31) 



The density matrices describing Eve's probes after the 
x-y basis has been announced are 



Px = F\à 00 )(à Q0 \ + D\à i)(à i\ 



p y = F|àn)(àn| + -D|ài )(àio| 



(32) 



(33) 



From equations ( p5[ ) we can see the four probe states form 
two orthogonal sets. One set {|àio), |àoi)} occurs with 
probability D and the other set {|Soo), |ón)} occurs with 
probability F. What Eve can do is devise a measure- 
ment that unambiguously discriminates these two sets. 
Because the measurement will also be compatible with 
the sets it will not change the states of the probes. Eve 
can also teli, depending on the result of this first mea- 
surement, whether she has caused a disturbance to Alice 
and Bob's key. The second problem is now to discrimi- 
nate between two, generally nonorthogonal states in the 
same set. The basis that gives Eve the best chance of 
guessing the state correctly is the intermediate or Breid- 
bart basis. For two states \ipi) and \ip2) the probability 
of guessing the state correctly is ÍÍM 



(34) 



We know the overlaps between the two sets from equa- 
tions (H), (H), @ and @. These are 



(aoo an; 



(aii 000; 



F\ 
F 



(35) 



(«oi «ió; = ( a iol a oi/ 



£1 
D 



(36) 



So the probability of Eve guessing the correct state is 

P c = FPf + DPf (37) 



Where Pf = 1/2 + 1/2^1 - (FJF) 2 for example. It 
actually turns out that equation (|37| ) is maximized when 
the probes in both sets have the same overlap i.e. 



Fi 
F 



Di 
D 



(38) 



So Pf = Pf and because F + D = 1 we have the op- 
timum incoherent eavesdropping strategy. Eve has the 
probability to guess correctly 



Pr 



1 



2 v d' 



1 



(39) 



Using the relations F + D = 1, F - D = F 1 + D x and 
equation (p8[) we can express P c in terms of D only giving 



Pr 



VD(1 - D) 



(40) 



This strategy does much better than the intercept-resend 
strategy at the cost of added technological complexity. 
Grifhths and Niu [Q have proposed the quantum circuit 
that does the job. This strategy can also produce deter- 
ministic information on every state Alice sends to Bob at 
the price of completely randomizing their sifted key. This 
is a good example of the information-disturbance trade 
off. Eve has a better chance of distinguishing her probe 
states the smaller she makes their overlap until they be- 
come orthogonal to one another and can be discriminated 
perfectly. The price for decreasing the overlap between 
Eve's probes is that Bob's density matrices become more 
uniformly mixed between the wanted and the unwanted 
states i.e. D increases. This comes from nature's en- 
forcement of unitary evolution, that all the overlaps must 
remain the same before and after the evolution. 

We know this is the optimum strategy from the deriva- 
tion given by Fuchs et al. ||. The other interesting 
thing about this strategy is that can be regarded as an 
asymmetrical cloning machine, taking Alice's state and 
producing two copies of unequal fidelity. One good copy 
is passed on to Bob and one bad copy that is kept by 
Eve. There are bounds on copying machines and the re- 
sult in equation ( |40| ) can be found from work by Cerf 
et al. ]Ï3| . However in the derivation presented above 
the probe lives in a 4 dimensional Hilbert space, in other 
words the probe consists of two qubits. Using a cloning 
machine the probe need only be of 2 dimensions, a single 
qubit. This has been shown by Niu and Griffiths p3. 
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C. What can Alice and Bob do? 

What can Alice and Bob do about this situation if 
they know about both of these strategies? The condition 
is that Alice and Bob can recover a secret key by one 
way privacy amplification if Eve's mutual information on 
Alice or Bob's bit string is less than the mutual informa- 
tion Alice and Bob share M, |(| . Formally this constraint 
is I(A;B) > max{I(E;B) 7 I(A;E)}, where I(A; B) is 
the mutual information between Alice and Bob, I(A; E) 
is the mutual information between Alice and Eve and 
I(E; B) is the mutual information Eve and Bob share. 
We use the one way result for simplicity. 

The average mutual information Alice and Bob share 
on the sifted key after públic announcement of the basis 
in the presence of an eavesdropper is just the average 
mutual information on a binary symmetric channel p5[ . 
The disturbance, D, an eavesdropper introduces looks 
like a data flipping rate to Alice and Bob. 

I(A;B) = \og2 + D\ogD + (1 - D)\og(l - D) (41) 

I{A\ B) can be expressed in bits by taking the logarithms 
to the base 2 or nats by taking logarithms to the base e. 
Equation (|ï|) can be expressed morc symmctrically in 
terms of a function (f>(z) |] as 



I(A;B) 



(1 - 2D) 



(42) 



Where <f>(z) is 



4>{z) = (l-z) log(l -z) + (l + z) log(l + z) (43) 

The average mutual information Alice and Eve, I(A; E), 
and Eve and Bob share, I(E;B), are equal for these 
strategies. The probability of the bit being flipped in 
this case is just 1 — P c . Expressed in terms of the func- 
tion 4>(z) this is 

I(A;E) = I(E;B) = ~4>[1- 2(1 -P c )] (44) 

By comparing equation ( [Í2"|) with equation (Q) we can 
find the maximum disturbance at which Alice and Bob 
can expect to obtain a secret key by privacy amplification 
i.e. I(A;B) > I(A;E). For a secret key to be obtained 
by one way privacy amplification 



D < 1 - P c 
For the intercept-resend strategy this is 

D< 1 



2(1 + y/2) 



(45) 



(46) 



for secret key generation to be possible and for the opti- 
mal incoherent strategy 



D < 



2-\/2 



1 ; 
0.9 
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la 
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0.05 
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0.15 
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0.25 



(47) 



FIG. 2: The average mutual information as a function of the 
error rate, D, for each strategy. The point at which I(A; B) 
crosses with I(A; E) is the point at which Alice and Bob can 
no longer distill a secret key by one way privacy amplification. 



This means if the channel has a noise level greater than 
this value then Alice and Bob cannot use it for quantum 
key generation as they should assume all disturbance to 
derive from an eavesdropper || if they are using one way 
privacy amplification. If they detect disturbance above 
this level then they must try the whole key generation 
process again or give up. However, in a practical implc- 
mentation of quantum cryptography this may be over- 
conservative |Í7j. The average mutual information be- 
tween Alice and Eve and Alice and Bob in bits for both 
strategies is shown in figure 0. 



III. INCOHERENT EAVESDROPPING: LÀSER 
PULSES 

In this section we use the results from section [ÏÏ] to form 
better strategies when the light source is a làser pulse 
that can be modelled by a mixture of number states with 
a Poissonian photon number distribution. All of these at- 
tacks use a beam-splitter apart from the photon-number 
splitting attack. In the photon-number splitting attack 
an eavesdropper can make a decision on what her best 
action should be because she can measure the number 
of photons in the pulse non-destructively. We start by 
introducing a few tools needed for this next part. 



A. The beam-splitter 

A beam-splitter either refleets a photon with some 
probability r or it transmits it with probability t. We 
are going to be dealing with lossless beam-splitters so 
r + t = 1. The beam-splitter is shown in figure |. We 
can describe the action of the beam-splitter on a num- 
ber state \n) entering through channel a and the vacuum 
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channel b 



channel a 




channel c 



channel d 



FIG. 3: A beam-splitter: Photons going into channel c have 
been transmitted with probability í, photons going into chan- 
nel d have been reflected with probability r if all photons 
arrive from channel a. 



state |0), entering through channel b as 

n 

\n) a ® |0) fc — > J2 c ^y 



n - i)d 



(48) 



The Cí's are the probability weighting for each situation. 
If we take the reflection or transmission of a photon as 
being independent of each other than the c$ are given by 
the binomial formula normalized appropriately 



íV 



(49) 



Where 



i! 



ij i\(n-i)\ 
So the probability of detecting j photons in channel c is 



l(0'lc<8<n-j'|«l)Eci 



I"- - i)d) 



i=0 



j\{n-j)\ 



t j (i-ty 



(50) 



B. Representation of làser pulses 

In the ideal situation one would what to use a light 
source that emits single photons on demand. Unfortu- 
nately sources that emit single photon number states are 
not available yet. Practical quantum cryptography usu- 
ally uses an attenuated làser pulse. These pulses can be 



modelled as a mixed state with a Poisson number state 
distribution or as a superposition of number states with 
a Poisson distribution, a coherent state. In the following 
analysis we calculate vàlues using a coherent state as the 
input although strictly speaking the input state is mixed 
when the logical bit vàlues are encoded onto the polari- 
sation. However, whichever input state is used gives the 
same answers for the vàlues we are interested in, those 



given in section III C and onwards. The probability of de- 
tecting n photons in a pulse with mean photon number 
/j, is given by 



Pn 



(51) 



If Alicc and Bob's quantum channel, the channel they use 
for sending the states that make up the key is lossy, the 
probability of detecting n photons when the pulse gets 
to Bob is 



Pn — e . 



(52) 



Where r\ is the transmission efficiency of the channel, the 
probability that each photon has of being detected by 
Bob. When r\ — 1 the channel has no loss, all photons 
in the pulse make it to Bob. When rj = the channel is 
completely opaque. 

The operation of the beam-splitter on a light pulse 
entering from channel a (figure y) looks like 

00 00 n 

y^VPn~\n}q®\0)b — ► ^2^/p7i^Ci\i) c ®\n-i) d (53) 

n=0 n=0 i=0 

The probability to find j photons in channel c is 

00 oc n 

m—0 n—0 i—0 



C. Eavesdropping attacks using a beam-splitter 

We can know formulate an incoherent attack based on 
beam-splitting. In a practical implementation, a làser 
produces states that give the chance that múltiple pho- 
tons will be detected, a good scenario for an eavesdropper 
trying to evade detection. All current quantum crypto- 
graphic systems use these sources and this will be the 
case until reliable, efficient, single photon sources become 
available. Work has also been done on these attacks by 

The eavesdropper has positioned her beam-splitter in 
Alice and Bob's quantum channel and replaced their lossy 
quantum channel with a lossless one (77 = 1). The beam- 
splitter is characterized by its transmission coefficient, t, 
and its reflection coefficient r = 1 — í. These are just the 
probabilities that a photon incident on the beam-splitter 
is transmitted or reflected respectively. Alice sends po- 
larisation encoded Poissonian distribution mixed photon 
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Alice 



Bob 



Eve 



FIG. 4: Beam-splitter attack scenario A. The arrows in Al- 
ice's, Bob's and Eve's channels represent the detection of at 
least one photon. The eavesdropper profits most from this 
situation. 



number states to Bob. These are characterized by their 
mean photon number /i. We have four scenarios that 
can happen during Eve's attack labelled A, B, C and D. 
These scenarios will be quoted when formulating specihc 
attacks later. 



1. Scenario A (figure^) 

Alice has emitted a state with more than one photon 
in it. At least one of these photons is reflected at the 
beam-splitter and travels into Eve's channel and at least 
one photon is transmitted by the beam-splitter into Bob's 
channel. This means Eve can obtain this state for free. 
She can store the photon provided she has the technol- 
ogy, until Alice and Bob announce the basis publicly and 
then discover the photon's state unambiguously. In these 
circumstances Eve does not cause an error on the sifted 
key. 

Scenario A is the ideal outcome for Eve, she cannot 
be detected and she gets deterministic information pro- 
vided she can store and preserve the photon or probe's 
state until públic announcemcnt of the basis. For this 
scenario to occur there needs to be at least two photons 
and at least one in each channel. To find the probability 
for scenario A to occur this means we have to alter the 
summation limits for the beam-splitter operation on the 
pulse to give 



OO 71 — 1 



(55) 



77=2 i=l 



We can replace the beam-splitter part, the last summa- 
tion on the right by reordering i.e. 



]T M 2 = 1 - |c | 2 - |c„| 2 = 1 - r n - í" (56) 
Putting in the explicit form of p n and making use of 



r = 1 — t we have 

oo n 

P A = e-»Y j ^-[\-(l-t) n ~t n ] (57) 

t—^ 91.1 



77=2 



The remaining summation can also be dealt with using 
the same trick 



> — r = 1 + x + 777 



77 = 



So with the limits in equation (^ 

°° n 

^ n\ 

n=1 

After some àlgebra Pa is 
P A = 1 + e-" 



x- 1 



(58) 



(59) 



e -M* _ e -^(i-t) 



1 + e-" - 2e~ï cosh[/j(í - 1/2)] 



(60) 



Pa is maximized when t — 1/2 (i.e. cosh(a;) reaches a 
minimum when x — 0) but maximizing this probability 
means changing the probabilities for the other scenarios 
which may not be the best thing to do as Eve is trying 
to make her presence as inconspicuous as possible. 



2. 



Scenario B (figure 



Alice has emitted a state with one or more photons in 
it. However all the photons in the state are reflected into 
Eve's channel. This is a bad situation for Eve. There 
is no chance that this state will form part of Alice and 
Bob's sifted key and the second part of the bad news is 
that Eve is lowering the proportion of the time Bob is 
cxpecting to receive a click at his detectors. Bob expects 
a certain proportion of the time not to receive a photon 
because sometimes the pulse sent by Alice is the vacuum 
state and Alice and Bob's original channel has a trans- 
mission emciency. He will know what proportion this 
should be by calculating it from the settings of Alice's 
cquipmcnt; what she has set the mean photon number, 
/i, of the pulscs to be by running the light through an 
attenuator and by making measurements of the channel 
transmission efficiency, r/. This scenario reduces the pro- 
portion of states sent that have at least one photon in 
them from Bob's point of view. 

The probability for this occurrence is 



Pb = y^ffnM 



77=1 77=1 

Again rearranging the summation we have 
P B = e~ l·lt - e-" 



(61) 



(62) 
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4- Scenario D 



Alice 



Bob 



This is a simple occurrence. This is just the situation 
that the pulse Alice emits has no photon in it. It is the 
vacuum state. In this case neither Alice, Bob or Eve can 
get any information. The probability of zero photons in 
the state is 



Eve 



FIG. 5: Beam-splitter attack scenario B. The arrows in Alice's 
and Eve's channels represent the detection of at least one 
photon. Note the absence of a photon in Bob's channel. 



(65) 



5. Photon number distributïon after the beam-splitter 

When Eve inserts a beam-splitter into Alice and Bob's 
quantum channel she alters the probability of the number 
of photons Bob deteets. The probability that Bob finds i 
photons in his channel was given by equation ( |54| ) . Writ- 
ten explicitly this is 



Alice 



Bob 



P(i) = 



W) % f, \M(l-t)] 
il ^ (n-i)\ 



Eve 



FIG. 6: Beam-splitter attack scenario C. The arrows in Al- 
ice's and Bob's channels represent the presence of at least one 
photon. 



3. Scenario C (figure |^) 

In this scenario all photons in the pulse are transmit- 
ted by the beam-splitter into Bob's channel. This is not 
as bad a situation as scenario B but it is not as good 
as scenario A. The states in this scenario may go on to 
form part of Alice and Bob's sifted key and Eve does not 
cause any additional reduction in the proportion of non- 
empty pulses reaching Bob. Just because Eve does not 
receive a photon in her channel does not mean she need 
be completely ignorant of its identity. Eve could cmploy 
one of the single photon strategies in section |ï| at the 
cost of introducing errors on Alice and Bob's sifted key. 
The probability that scenario C oceurs (all photons end 
up in Bob's channel) is 



oo 



-t" 



71=1 



(63) 



Which becomes 



(64) 



-ut (/**)* 



(66) 



On comparison with equation ( p2[ ) we can see that the 
addition of the beam-splitter does not change the overall 
shape of the photon number distribution; it is still Pois- 
sonian (although with a smaller average number of pho- 
tons). If Eve then replaces Alice and Bob's lossy chan- 
nel described by r\ with one that is lossless (rj = 1) she 
can thcn choosc the transmission coefhcient of the beam- 
splitter, t to match r\ [r] = t). In this way Eve does not 
cause any change the photon statistics Bob expeets. 



D. Intercept-resend attack with a beam-splitter 

A strategy like this could be implemented with today's 
technol ogy. This sectio n borr ows the main results from 
section 



II A and section [II C 



This is what Eve does: If she gets photons in her chan- 
nel she measures them in every instance that the situa- 
tion oceurs. When scenario A oceurs, only the photons 
in Bob's channel will be subject to error checking so she 
will not cause any errors on th e sifted key. Borrowing the 
main result from section II A Eve's probability of guess- 
ing the state correctly from scenario A alone is 



P l - r {D 



V2 + 2 



(67) 



The overall probability that Eve guesses the correct state 
when scenario A oceurs is 



P A P l ~ r {D = 1/4) 
1-Po-Pb 



(68) 
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The denominator in the equation above appears because 
we only includc thosc situations in which the states have 
the opportunity to form part of Alice and Bob's sifted 
key. It is like a normalizing factor. Eve may get more 
than one photon in her channel when scenario A occurs. 
If she then measures them in the intermediate basis shc 
may get both measurement results Mq and M±. What 
should Eve conclude now? We make an approximation 
here and say that Eve always gets a single result. To 
give some justification of this if Eve has a detector that 
can measure the number of photons incident on it but de- 
stroys the photons in the process then when Eve analyzes 
more than one photon she can be reasonably certain that 
the bit value sent was the one that resulted in the higher 
number of photon detections for a that outeome. The 
only time Eve must make a 50/50 guess is when there are 
the same number of detected photon for each measure- 
ment outeome. However, more than one photon detected 
for only one outeome will give Eve a higher probability 
of guessing the state correctly so we think this is not a 
bad approximation. 

The second part of the strategy is that when Eve does 
not get a photon in her channel she measures a propor- 
tion, e, of the photons that make it into Bob's channel. 
She only does this a proportion of the time to control the 
level of disturbance she inflicts on Alice and Bob's sifted 
key. The disturbance, Dab, that Alice and Bob see in 
their sifted key is going to be different from the D ap- 
pearing in the single photon strategies because they only 
see this disturbance on a proportion of the bits, those 
that came from scenario C namely 



1-Po-Pb 
Therefore the disturbance Alice and Bob see is 

D(é)P c 



D AB (e) 



1-Pq-Pb 



(69) 



(70) 



The probability of guessing the state correctly from sce- 
nario C is given by 



peorrect^ 



P i - r (D)P c 
í-Po-Pb 



(71) 



with a lossless one and make her beam-splitter transmis- 
sion be t — rj to give the same photon number statistics 
Bob expeets. Now what Eve has to do to avoid Alice and 
Bob's suspicions is fix the value of t to the value of rj as 
well as lowering the error rate Alice and Bob see, Dab- 
Giving the explícit form of equation [7^ we have 



y/2 + 2 



e -M(i-*)[V2(l/4_.D)] (74) 



The disturbance Alice and Bob see (the error rate in their 
sifted keys) is 



(75) 



With equation ( |75| ) Eve can control the error rate and 
by knowing rj she can then calculate how likely she is to 
guess the correct vàlues of the bits using equation ([74]). 



E. Optimal incoherent attack with a beam-splitter 

This attack is similar to the last one considered except 
now the eavesdropper has bette r tec hnology and can use 
the strategy reported in section |II B| and extract more in- 
formation for a fixed disturbance. When scenario A oc- 
curs this time, Eve can perform an interaction between 
the probe and the photon in her channel to maximize the 
disturbance to the photon's state and maximize the dis- 
tinguishability of the probe. She can then store the probe 
and wait until the basis is announced before measuring 
it. Now she can unambiguously determine which state 
Alice sent to Bob. When scenario C occurs the eaves- 
dropper reverts to the single photon strategy and again 
Alice and Bob will notice a smaller average disturbance 
Dab then D because this situation does not oceur all the 
time. Eve again should set r] = í to give Bob the same 
photon statistics and Dab will be given by equation (|7^) . 

So scenario A occurs. The eavesdropper has a proba- 
bility of being correct from this circumstance that is 



r>correct 



Pa 



í-Po-Pb 



(76) 



Where (borrowed from section II A ) 



There is no additional multiplicr because Eve gains dc- 
terministic information i.e. P opt (D = 0.5) = 1. 

Scenario C occurs giving a probability of being correct 



P l - r (D) = ^/2D + ^ 



(72) 



So the total probability of guessing the state correctly is 



P A P l - r {D = 1/4) + P c P l - r (D) 
1 Pq Pb 



(73) 



The probabilities of each of the scenarios is dependant on 
the tra nsmis sion coefficient of the beam-splitter, t. From 
section [II C it was found that if Alice and Bob are ex- 



pecting to see a line with loss rj then Eve can replace it 



P c P opt {D) 
1-Po-Pb 



(77) 



P opt (D) is the pro babil ity of guessing the state correctly 
taken from section iïlBl and is as a reminder 



1 



P op \D) = - + V£>(1 - D) 



(78) 



The total probability that Eve guesses the correct state 
is 



r>correct 
r tot 



P A + PcP opt {D) 
1-Po-Pb 



(79) 
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The total probability of Eve guessing the state correctly 
given explicitly is 



Tjcorrect 
r tot 



l _ - 7-0(1 - D)] (80) 



F. Photon-number splitting attack 

What an eavesdropper can do here is perforin vmlim- 
ited numbers of quantum non-demolition (QND) mea- 
surements with unit efficiency. QND measurements are 
measurements that give the value of one observable with- 
out effecting the other degrees of freedom. The QND 
measurement Eve is interested in is one which telis her 
the number of photons in the làser pulse without effecting 
their polarisation. These measurements are very difficult 
to perforin, the first demonstration bcing by Nogués et 
al. jÏ8| . This eavesdropping attack is far beyond present 
technology. Work on these kinds of attack has also been 
done by |ï^, ^0|. The flip side is that if Alice has the 
technology to perform QND measurements then she can 
simply stop any pulse that has more than one photon in 
it before sending it to Bob. In this case an eavesdropper 
will have revert to the strategies given in section Wc 
will here analyze the case of the more advanced eaves- 
dropper. 

Using this attack Eve can discover the number of pho- 
tons in the pulse and then choose her actions accordingly. 
If there is more than one photon in the pulse she just 
splits off a single photon and lets the others pass to Bob. 
She can then perform an interaction with her probe and 
store it until the basis is announced then make a mea- 
surement that will give her the correct value every time. 
If there is more than one photon in the pulse then Eve 
does not cause an error on Alice and Bob's sifted key If 



she sees only one photon then she performs the optimal 
incoherent attack at the cost of adding some disturbance. 
If Alice and Bob have a lossy channel with some trans- 
mission efnciency rj 1 Eve can replace this channel with 
a lossless one then selectively block the single photon 
pulses to give the same proportion of non-empty pulses 
Bob is expecting. In this way Eve may even be able to 
obtain deterministic knowledge of Alice and Bob's sifted 
key without causing any errors depending on the vàlues 
of the original channel transmission efficiency r\ and the 
mean photon number /i. 

From equation ( |5l"| ) the probability that Alice sends a 
pulse containing zero and one photons are 



Pn 



P x = \ie 



(81) 



(82) 



And the probability for detecting more than one photon 
is 



P 



n>l 



(83) 



If Eve blocks a proportion k of the pulses containing one 
photon then her probability of guessing the state cor- 
rectly is 



P° 



P»>i + (i-*)PiP opt QP) 

1-P - kPi 



(84) 



The denominator is again there to exclude the circum- 
stances that Alice and Bob (and Eve in this case) do not 
use, all the empty pulses. The probability of Eve guessing 
the state correctly is given explicitly as 



J 



P° 
r i, 



\D) = 



1 - e-"(l + n) + (1 - «)^e-^[l/2 + y/D(l - D) 
1 - e-^(l + fiK) 



(85) 



r 



The disturbance Alice and Bob see when Eve uses this 
strategy is 



Dai 



(1 - «)Pi 

1-Pq-kP! 



-D 



(1 - K)fj,e-i" 
1 - e-í'(l + (j,k 



■D 



(86) 



If Alice and Bob's quantum channel has transmission ef- 
ficiency r], Eve can block a proportion, n, of the one pho- 
ton pulses if she replaces Alice and Bob's channel with a 
lossless one (77 = 1). We can equate the number of non- 
empty pulses Bob expects to see with a lossy channel 



to the number of non-empty pulses after Eve selectively 
blocks the single photon pulses. 



1 



This gives k as 



(1 - k)Pí + P n> x 



(87) 



(88) 



When k = 1 Eve has deterministic knowledge of the 
whole of Alice and Bob's key without causing any er- 
rors in it. Lossy lines and high mean photon numbers 
are therefore a huge security risk under this attack. The 
value of r\ as a function of the mean photon number, /z, 
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this occurs at is given by 



r?= 1- -ln(l + M) 



What can Alice and Bob do? 



(89) 



If Alice and Bob are trying quantum key distribution 
with attcnuatcd lascr pulscs instead of a singlc photon 
source what measures can they take to ensure that Eve 
does not obtain their key? The first thing Alice and 
Bob can do is check the error rate in their keys. Using 
the same criteria as in section [I C for one way privacy 
amplification to be successful then 



Dab < 1 



Tjcorrect 
r tot 



If Eve is using the intercept-resend strategy presented 
here Alice and Bob must detect a lower disturbance than 



Dab < 



2 - ^2(1 



4(1 + V2) 



(90) 



to be able to distill a secret key. If Eve is using the 
optimal incoherent attack then 



D 



AB 



<{'- 



-ít(l-í?) 



(91) 



And finally if Eve is using the photon-number splitting 
attack then 



Dab < ( 



2-V2 (í+^e-^ - 



'-)[ 



1 - e-w 



(92) 



The average mutual information as a function of Dab, 
the error rate in Alice and Bob's sifted key is plotted for 
each of these strategies in figure[7]for rj = 0.9 and (j, = 1. 

Apart from measuring the disturbance or error rate in 
their keys, Alice and Bob can also monitor coincidence 
counts O] . Bob can count the number of times both of 
his detectors click when he chooses the wrong basis i.e. 
he gets both results from his measurement. These oc- 
currences come from múltiple photons in the làser pulse. 
Bob knows the mean photon number of the pulses Alice 
is sending and the transmission efficiency of their channel 
so he can work out how often this should occur. This is 
what he can do to monitor the photon number distribu- 
tion if he does not have a detector that can discriminatc 
the number of photons incident on his detector. Bob 
expeets 



1 



coincidence 



-rjju 



2-^ n\ 2-^1 



P, 



coincidence 



n=2 



í=i 



-7J/1 



2e~ — ) 



(93) 



(94) 
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FIG. 7: The average mutual information as a function of the 
error rate, Dab, for each strategy at a fixed rj = 0.9 and 
pt = 1. The point at which I(A; B) crosses with I(A; E) is the 
point at which Alice and Bob can no longer distill a secret 
key by one way privacy amplification. 



The 2~™ term on the right hand side of equation (|9£ 
is because when Bob uses the wrong basis he effectively 
has a 50/50 beam-splitter and the 1/2 factor comes from 
the fact that Bob chooses the wrong basis half the time. 
Eve will not effect the photon number distribution that 
Bob sees in the beam-splitting attacks providing she has 
set the beam-splitter transmission to equal the transmis- 
sion efnciency, rj, of their original lossy quantum channel 
as shown in section III C . The photon number distribu- 
tion is still Poissonian. However, with the more powerful 
QND attack which is dependant on the number of pho- 
tons in the pulse the photon number statistics Bob sees 
will no longer be Poissonian. In the strategy above we 
fixed the number of non-empty pulses to be equivalent 
to Bob's expectations. In doing this though we have re- 
duced the probability of Bob finding a pulse containing 
more than one photon which Bob can detect from the re- 
duction in the proportion of coincidence counts. A more 
detailed analysis of this is g iven by Fèlix et al. [|Ï7j and 
Lütkenhaus and Jahma |2l|. 



IV. CONCLUSION 

We have given a simple derivation of beam-splitting 
and photon-number splitting attacks on the BB84 pro- 
tocol in a realistic implementation: that of using a làser 
pulse to send signals instead of the ideal single photon 
source and of using a channel that is lossy. From these 
results we found a bound on the maximum disturbance 
or error rate Alice and Bob can accept in their sifted 
keys to successfully complete privacy amplification and 
give Eve an insignificant amount of knowledge of the key 
once this process is complete. These results make no 
approximation of small mean photon number. 
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